0

I need to configure the HSTS (HTTP Strict-Transport Header) in Linux. I have added the following on the Tomcat/Conf Web.xml file: httpHeaderSecurity org.apache.catalina.filters.HttpHeaderSecurityFilter

    <init-param>
  <param-name>hstsEnabled</param-name>
  <param-value>true</param-value>
</init-param>
<init-param>
  <param-name>hstsMaxAgeSeconds</param-name>
  <param-value>31536000</param-value>
</init-param>
<init-param>
  <param-name>hstsIncludeSubDomains</param-name>
  <param-value>true</param-value>
</init-param>
 <async-supported>true</async-supported>

I have also added port 80 on the server.xml file and I still cannot the Strict Transport Header.

0

The HSTS is a security configuration for HTTPS sites and is not to be configured with plain HTTP, as you are doing.

See Mozilla - Strict-Transport-Security

The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP.

As per the requirements of the link in your comment, to have HSTS in Tomcat, you need to have a web server frontend, on the same host.

In order to be accepted to the HSTS preload list through this form, your site must satisfy the following set of requirements:

  • Serve a valid certificate.

  • Redirect from HTTP to HTTPS on the same host, if you are listening on port 80.

  • Serve all subdomains over HTTPS.

Per our FAQ, it is off topic guiding you on the specific steps to do it.

A possible solution is to configure Apache+SSL+a X.509 certificate as a front end for your site/Tomcat. Beware that when doing that, there are also specific steps for Tomcat too. See also the tomcat 9 official SSL guide.

2
  • Thank you for your quick reply. I used this link to configure it: netiq.com/communities/cool-solutions/hsts-for-tomcat do you have something that I can look at to configure it? – ejames0512 Sep 14 '18 at 16:50
  • While getting outside the realm of the question and getting into off-topic land, I added clarifications to the answer to guide you. Nevertheless, it is not an easy task to put https working, mind you. I advise getting professional consulting help for this first time or your local friendly fellow Unix sysadmin. – Rui F Ribeiro Sep 14 '18 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.